Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · ShinyHunters · Unknown · misp-galaxy + mitre-attack · refreshed 2026-10-06 · on the wire

ShinyHunters

  • UNC6240
  • Bling Libra

MITRE G1057 ↗

ShinyHunters — ATT&CK roseSH

attack rose · 46 techniques across 12 tactics

Last 30 days

last seen 2 d ago
dispatches78
victims8
CVEs seen0
seen against
Germany
sectors
Not Found · Healthcare

What changed

ledger · newest first
  1. —todaynew CVE1 new CVE: CVE-2021-35587
  2. —17 d agovictimsvictim count 29 → 32 (+3)
  3. —24 d agovictimsvictim count 28 → 29 (+1)
  4. —1 mo agovictimsvictim count 27 → 28 (+1)
  5. —1 mo agovictimsvictim count 26 → 27 (+1)
  6. —1 mo agonew CVE1 new CVE: CVE-2026-35273

Analyst brief

misp-galaxy + mitre-attack

ShinyHunters is a cybercriminal group of unknown origin that is motivated by financial gain. The group is known for its sophisticated attacks against a wide range of targets, including businesses, organizations, and government agencies. ShinyHunters typically uses phishing attacks and exploit kits to gain access to victim networks, where they deploy malware to steal sensitive data, such as names, addresses, phone numbers, Social Security numbers, and credit card information.

Observed targets (as stated by the sources)

6 countries · 8 sectors
United StatesSwitzerlandIsraelGermanySwedenFrance

assessed originnot stated by sourcesobserved targets · 6

countries · 6

  • United States
  • Switzerland
  • Israel
  • Germany
  • Sweden
  • France

sectors · 8

  • Healthcare
  • Technology
  • Not Found
  • Financial Services
  • Manufacturing
  • Government & Defense
  • Agriculture and Food Production
  • Retail & E-Commerce

as stated by MISP galaxy / ransomware.live — not inferred

Kill chain

MITRE ATT&CK Enterprise · tap a technique

46 techniques · 12 of 15 tactics

  1. Reconnaissance

    5 techniques

  2. Resource development

    6 techniques

  3. Initial access

    2 techniques

  4. Execution

    4 techniques

  5. Stealth

    5 techniques

  6. Credential access

    3 techniques

  7. Discovery

    7 techniques

  8. Lateral movement

    2 techniques

  9. Collection

    4 techniques

  10. Command and control

    4 techniques

  11. Exfiltration

    1 technique

  12. Impact

    3 techniques

select a technique

Arsenal

1 tools
Tools
Tools · 1ATT&CK
TorS0183 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

CVEs cited sources tie to ShinyHunters

1 on CISA KEV
  1. CVE-2026-35273KEVEPSS 9.4% · 2026-09-28
    1. “ShinyHunters has exploited zero-day vulnerability CVE-2026-35273 against Oracle PeopleSoft application infrastructure.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

    2. “The activity was observed between May 27, 2026, and June 9, 2026 and is consistent with the exploitation of CVE-2026-35273 , a critical remote code execution vulnerability (CVSS 9.8) in the Environment Management component.”

      cited as exploiting · named nearby · source: cloud.google.com ↗ · 2026-10-17

    3. “ShinyHunters’ Fresh Oracle PeopleSoft Campaign The extortion group has modified its exploit in new attacks targeting the PeopleSoft vulnerability CVE-2026-35273.”

      attributed by a report · named nearby · source: our dispatch · 2026-09-28

  2. CVE-2021-355872026-10-17
    1. “According to data obtained from a public Telegram channel operated by the ShinyHunters team, the threat actor persona ‘Yukari’ exploited an Oracle Access Manager vulnerability (CVE-2021-35587).”

      cited as exploiting · source: blog.eclecticiq.com ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

On the wire

2 dispatches · newest first
  1. FBI job portals remain offline after ShinyHunters claims breach via PeopleSoft zero-day
  2. ShinyHunters Targets Education Sector with Oracle PeopleSoft ExploitKEV

Take it with you

keyless · no signup

References

10 sources
  1. 1.cyberwarzone.com/shinyhunters-22-year-old-member-pleads-guilty-to-cyber…
  2. 2.bitdefender.com/blog/hotforsecurity/pizza-hut-australia-leaks-one-mill…
  3. 3.justice.gov/usao-wdwa/pr/alleged-french-cybercriminal-appear-seatt…
  4. 4.attack.mitre.org/groups/G1057
  5. 5.blog.eclecticiq.com/shinyhunters-calling-financially-motivated-data-extort…
  6. 6.ic3.gov/PSA/2026/PSA260515
  7. 7.cloud.google.com/blog/topics/threat-intelligence/voice-phishing-data-ex…
  8. 8.intel471.com/blog/shinyhunters-data-breach-mitre-attack
  9. 9.unit42.paloaltonetworks.com/shinyhunters-ransomware-extortion
  10. 10.cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-e…

Track ShinyHunters on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.